CVE-2026-64299

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Linux Kernel Tracing Glob Matching

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-03

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-02

NVD

CVE-2026-64299

EUVD

EUVD-2026-49011

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 4.10 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's tracing subsystem. It involves an out-of-bounds read during glob matching in string event fields. String fields may not be NUL-terminated, but the glob matching function ignored the field length and scanned until a NUL byte, causing it to read past the end of the field.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires kernel-level access to detect. Check if your kernel version includes the fix by running uname -r and comparing against patched versions. Monitor kernel logs for KASAN slab-out-of-bounds errors using dmesg | grep -i kasan.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel slab-out-of-bounds read, potentially leading to system crashes or information leaks. It affects systems using the Linux kernel with tracing enabled.

Compliance Impact

This vulnerability is a memory safety issue in the Linux kernel's tracing subsystem that could lead to out-of-bounds memory reads. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel memory management.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for CVE-2026-64299. If immediate patching is not possible, disable tracing features that use string event fields or restrict access to tracepoint functionality until the update is applied.

Hi! I’m here to help you understand CVE-2026-64299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70